M poseidon-cipher/src/circuit.rs → poseidon-cipher/src/circuit.rs

@@ -8,7 +8,7 @@
 use anyhow::Result;
 use plonky2::{
     field::{
-        extension::{FieldExtension, quintic::QuinticExtension},
+        extension::quintic::QuinticExtension,
         goldilocks_field::GoldilocksField as F,
         types::{Field, Field64},
     },
@@ -27,7 +27,7 @@ field::{CircuitBuilderNNF, OEFTarget},
     },
 };
 
-use crate::{Fq, TWO128};
+use crate::Fq;
 
 // Fq Target
 type FqT = OEFTarget<5, QuinticExtension<F>>;
@@ -59,19 +59,15 @@ let mut ct: [FqT; L + 1] = array::from_fn(|_| fqt_zero.clone());
 
         // build the circuit logic
         let f_zero = builder.constant(F::ZERO);
-        let n = FqT::new([nonce[0], nonce[1], f_zero, f_zero, f_zero]);
-        let two128: Fq = TWO128;
-        let l_two128: Fq = Fq::from_basefield_array([
-            F::from_canonical_u64(L as u64),
-            F::ZERO,
-            F::ZERO,
-            F::ZERO,
-            F::ZERO,
-        ]) * two128;
-        let l_two128_target: FqT = const_fqt_from_fq(builder, l_two128);
-        let nl128: FqT = builder.nnf_add(&n, &l_two128_target);
+        let n_l = FqT::new([
+            nonce[0],
+            nonce[1],
+            builder.constant(F::from_canonical_u64(L as u64)),
+            f_zero,
+            f_zero,
+        ]);
         let fq_zero: FqT = FqT::new([f_zero, f_zero, f_zero, f_zero, f_zero]);
-        let mut s: [FqT; 4] = [fq_zero, ks.x.clone(), ks.u.clone(), nl128];
+        let mut s: [FqT; 4] = [fq_zero, ks.x.clone(), ks.u.clone(), n_l];
 
         for i in 0..L / 3 {
             s = hash_state_target(builder, s);

M poseidon-cipher/src/lib.rs → poseidon-cipher/src/lib.rs

@@ -38,19 +38,20 @@ let r: BigUint = OsRng.gen_biguint_below(&GROUP_ORDER);
     &r * K
 }
 
-pub(crate) const TWO128: Fq =
-    QuinticExtension::<F>([F(F::ORDER - 1), F(F::ORDER - 1), F::ZERO, F::ZERO, F::ZERO]);
-
 pub fn encrypt(ks: Point, msg: &[Fq], nonce: [F; 2]) -> Vec<Fq> {
     let mut m = msg.to_vec(); // pad m
     m.resize(m.len().next_multiple_of(3), Fq::ZERO);
     assert!(m.len() < F::ORDER as usize);
 
-    let l = Fq::from(F::from_canonical_u64(msg.len() as u64));
-    let nonce_5: [F; 5] = [nonce[0], nonce[1], F::ZERO, F::ZERO, F::ZERO];
-    let n = Fq::from_basefield_array(nonce_5);
-    let nl128: Fq = n + l * TWO128;
-    let mut s: [Fq; 4] = [Fq::ZERO, ks.x, ks.u, nl128];
+    // bind the msg length and nonce into the initial state
+    let n_l = Fq::from_basefield_array([
+        nonce[0],
+        nonce[1],
+        F::from_canonical_u64(msg.len() as u64),
+        F::ZERO,
+        F::ZERO,
+    ]);
+    let mut s: [Fq; 4] = [Fq::ZERO, ks.x, ks.u, n_l];
 
     let mut ct: Vec<Fq> = vec![Fq::ZERO; m.len() + 1];
     for i in 0..m.len() / 3 {
@@ -72,11 +73,14 @@ ct
 }
 
 pub fn decrypt(ks: Point, ct: &[Fq], nonce: [F; 2], l: usize) -> Vec<Fq> {
-    let l_fq = Fq::from(F::from_canonical_u64(l as u64));
-    let nonce_5: [F; 5] = [nonce[0], nonce[1], F::ZERO, F::ZERO, F::ZERO];
-    let n = Fq::from_basefield_array(nonce_5);
-    let nl128: Fq = n + l_fq * TWO128;
-    let mut s: [Fq; 4] = [Fq::ZERO, ks.x, ks.u, nl128];
+    let n_l = Fq::from_basefield_array([
+        nonce[0],
+        nonce[1],
+        F::from_canonical_u64(l as u64),
+        F::ZERO,
+        F::ZERO,
+    ]);
+    let mut s: [Fq; 4] = [Fq::ZERO, ks.x, ks.u, n_l];
 
     let mut m: Vec<Fq> = vec![Fq::ZERO; ct.len() - 1];
     for i in 0..ct.len() / 3 {